Microsoft Defender CVEs: CVE-2026-41091 (local privilege escalation) and CVE-2026-45498 (denial of service)

Two new Microsoft Defender vulnerabilities have been published in the National Vulnerability Database with corresponding entries in Microsoft’s Security Update Guide: CVE-2026-41091 and CVE-2026-45498. Both pertain to core Defender components on Windows endpoints, making them relevant for administrators and security teams that rely on Defender for antimalware protection.

CVE-2026-41091 is described as an improper link resolution before file access issue—often called a “link following” weakness. In practical terms, this class of flaw can occur when a privileged process follows a filesystem link (such as a junction or symlink) without adequate checks. According to the NVD summary, an authorized local attacker could leverage this condition to elevate privileges. The key point is “local” and “authorized”: an attacker would already need a foothold on the system to attempt this.

CVE-2026-45498 is a denial-of-service vulnerability in Microsoft Defender. The NVD entry labels it as DoS without further technical detail. In the Defender context, a successful DoS could degrade or interrupt protection and monitoring on affected machines, at least temporarily.

What’s confirmed vs. still unclear

• Confirmed: CVE-2026-41091 exists in Microsoft Defender and involves improper link following, enabling local privilege escalation by an authorized attacker. Source: NVD and Microsoft Security Update Guide entries.
• Confirmed: CVE-2026-45498 is a denial-of-service vulnerability in Microsoft Defender. Source: NVD and Microsoft Security Update Guide entries.
• Unclear from the public summaries: specific affected versions, exact exploit conditions, severity scores, patch availability timelines, and whether there is evidence of exploitation in the wild. Those details are not provided in the NVD snippets linked to Microsoft’s advisories.

Why it matters

Defender runs with elevated privileges and is widely deployed by default on Windows. A local privilege escalation route can help a post-compromise attacker gain higher-impact access, while a DoS in the antimalware engine could disrupt protection or incident response visibility. Even without exploit details, these categories of flaws warrant prompt review by defenders.

Practical next steps

Based on the available evidence, the most reliable way to proceed is to consult Microsoft’s official advisories and follow vendor guidance as it is updated:

• Microsoft Security Update Guide entry for CVE-2026-41091: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091
• Microsoft Security Update Guide entry for CVE-2026-45498: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498

Enterprises should track these pages for confirmation of affected components and any remediation or update instructions. If you manage Defender updates centrally, review your normal deployment and monitoring processes so you can apply vendor-recommended updates when they are available and verify Defender health afterward.

Limitations and caveats

Information currently public via NVD and the linked Microsoft advisories is concise. Without additional vendor detail, we cannot confirm affected versions, patch status, or real-world exploitation. This article will remain conservative on claims until Microsoft’s guidance provides more specifics.

In the meantime, maintain standard hygiene for Windows endpoints: keep security baselines current, monitor endpoint health, and review least-privilege practices to reduce the impact of any local escalation paths.

If you oversee Windows security tooling, bookmark the advisories above and fold them into your vulnerability management queue. As Microsoft updates those entries, prioritize actions according to your environment’s exposure and change windows.

Alex Mira

Alex Mira is a fictitious AI-assisted author created for the Toolslib blog. Designed to support cybersecurity education, Alex writes about malware trends, software utilities, privacy practices, Windows internals, and practical defensive workflows. Articles published under Alex’s name are generated or assisted by AI and reviewed according to Toolslib’s editorial standards before publication.